6.8 - RHSA-2009:0428

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	cups security update

Informations
Name	RHSA-2009:0428	First vendor Publication	2009-04-16
Vendor	RedHat	Last vendor Modification	2009-04-16
Severity (Vendor)	Moderate	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

The Common UNIXÂ® Printing System (CUPS) provides a portable printing layer for UNIX operating systems.

An integer overflow flaw, leading to a heap-based buffer overflow, was discovered in the Tagged Image File Format (TIFF) decoding routines used by the CUPS image-converting filters, "imagetops" and "imagetoraster". An attacker could create a malicious TIFF file that could, potentially, execute arbitrary code as the "lp" user if the file was printed. (CVE-2009-0163)

Red Hat would like to thank Aaron Sigel of the Apple Product Security team for responsibly reporting this flaw.

Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, the cupsd daemon will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

490596 - CVE-2009-0163 cups: Integer overflow in the TIFF image filter 491864 - Multiple PDF flaws

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2009-0428.html

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11546

Oval ID:	oval:org.mitre.oval:def:11546
Title:	Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.
Description:	Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted TIFF image, which is not properly handled by the (1) _cupsImageReadTIFF function in the imagetops filter and (2) imagetoraster filter, leading to a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0163	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section cups-devel is earlier than 1:1.1.17-13.3.58 AND cups is earlier than 1:1.1.17-13.3.58 AND cups-libs is earlier than 1:1.1.17-13.3.58 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section cups-devel is earlier than 1:1.1.22-0.rc1.9.27.el4_7.5 AND cups is earlier than 1:1.1.22-0.rc1.9.27.el4_7.5 AND cups-libs is earlier than 1:1.1.22-0.rc1.9.27.el4_7.5 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section cups-lpd is earlier than 1:1.3.7-8.el5_3.4 AND cups-devel is earlier than 1:1.3.7-8.el5_3.4 AND cups is earlier than 1:1.3.7-8.el5_3.4 AND cups-libs is earlier than 1:1.3.7-8.el5_3.4

Definition Id: oval:org.mitre.oval:def:13511

Oval ID:	oval:org.mitre.oval:def:13511
Title:	DSA-1773-1 cups -- integer overflow
Description:	It was discovered that the imagetops filter in cups, the Common UNIX Printing System, is prone to an integer overflow when reading malicious TIFF images. For the stable distribution, this problem has been fixed in version 1.3.8-1lenny5. For the oldstable distribution, this problem has been fixed in version 1.2.7-4etch7. For the testing distribution and the unstable distribution , this problem will be fixed soon. We recommend that you upgrade your cups packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1773-1 CVE-2009-0163	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	cups
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section cupsys-bsd DPKG is earlier than 1.3.8-1lenny5 AND cupsys-client DPKG is earlier than 1.3.8-1lenny5 AND cupsys-dbg DPKG is earlier than 1.3.8-1lenny5 AND cups-common DPKG is earlier than 1.3.8-1lenny5 AND cupsys DPKG is earlier than 1.3.8-1lenny5 AND libcupsys2 DPKG is earlier than 1.3.8-1lenny5 AND libcupsys2-dev DPKG is earlier than 1.3.8-1lenny5 AND cupsys-common DPKG is earlier than 1.3.8-1lenny5 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libcups2-dev DPKG is earlier than 1.3.8-1lenny5 AND cups-bsd DPKG is earlier than 1.3.8-1lenny5 AND libcupsimage2-dev DPKG is earlier than 1.3.8-1lenny5 AND libcupsimage2 DPKG is earlier than 1.3.8-1lenny5 AND cups-client DPKG is earlier than 1.3.8-1lenny5 AND libcups2 DPKG is earlier than 1.3.8-1lenny5 AND cups-dbg DPKG is earlier than 1.3.8-1lenny5 AND cups DPKG is earlier than 1.3.8-1lenny5 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section libcupsys2-gnutls10 DPKG is earlier than 1.2.7-4etch7 AND cupsys-common DPKG is earlier than 1.2.7-4etch7 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is alpha AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section cupsys-bsd DPKG is earlier than 1.2.7-4etch7 AND cupsys-client DPKG is earlier than 1.2.7-4etch7 AND libcupsys2-dev DPKG is earlier than 1.2.7-4etch7 AND libcupsimage2-dev DPKG is earlier than 1.2.7-4etch7 AND libcupsimage2 DPKG is earlier than 1.2.7-4etch7 AND cupsys-dbg DPKG is earlier than 1.2.7-4etch7 AND cupsys DPKG is earlier than 1.2.7-4etch7 AND libcupsys2 DPKG is earlier than 1.2.7-4etch7

Definition Id: oval:org.mitre.oval:def:13899

Oval ID:	oval:org.mitre.oval:def:13899
Title:	USN-760-1 -- cups, cupsys vulnerability
Description:	It was discovered that CUPS did not properly check the height of TIFF images. If a user or automated system were tricked into opening a crafted TIFF image file, a remote attacker could cause a denial of service or possibly execute arbitrary code with user privileges. In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by the AppArmor CUPS profile.
Family:	unix	Class:	patch
Reference(s):	USN-760-1 CVE-2009-0163	Version:	5
Platform(s):	Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	cups cupsys
Definition Synopsis:
Release section Ubuntu 7.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND cupsys-common DPKG is earlier than 1.3.2-1ubuntu7.10 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section cupsys-bsd DPKG is earlier than 1.3.2-1ubuntu7.10 AND cupsys-client DPKG is earlier than 1.3.2-1ubuntu7.10 AND libcupsimage2 DPKG is earlier than 1.3.2-1ubuntu7.10 AND libcupsimage2-dev DPKG is earlier than 1.3.2-1ubuntu7.10 AND libcupsys2-dev DPKG is earlier than 1.3.2-1ubuntu7.10 AND cupsys DPKG is earlier than 1.3.2-1ubuntu7.10 AND libcupsys2 DPKG is earlier than 1.3.2-1ubuntu7.10 OR Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND cupsys-common DPKG is earlier than 1.3.7-1ubuntu3.4 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section cupsys-bsd DPKG is earlier than 1.3.7-1ubuntu3.4 AND cupsys-client DPKG is earlier than 1.3.7-1ubuntu3.4 AND libcupsimage2 DPKG is earlier than 1.3.7-1ubuntu3.4 AND libcupsimage2-dev DPKG is earlier than 1.3.7-1ubuntu3.4 AND libcupsys2-dev DPKG is earlier than 1.3.7-1ubuntu3.4 AND cupsys DPKG is earlier than 1.3.7-1ubuntu3.4 AND libcupsys2 DPKG is earlier than 1.3.7-1ubuntu3.4 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND libcupsys2-gnutls10 DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section cupsys-bsd DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND cupsys-client DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND libcupsys2-dev DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND libcupsimage2-dev DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND libcupsimage2 DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND cupsys DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 AND libcupsys2 DPKG is earlier than 1.2.2-0ubuntu0.6.06.13 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section cupsys-bsd DPKG is earlier than 1.3.9-2ubuntu9.1 AND cupsys-client DPKG is earlier than 1.3.9-2ubuntu9.1 AND cupsys-dbg DPKG is earlier than 1.3.9-2ubuntu9.1 AND cups-common DPKG is earlier than 1.3.9-2ubuntu9.1 AND cupsys DPKG is earlier than 1.3.9-2ubuntu9.1 AND libcupsys2 DPKG is earlier than 1.3.9-2ubuntu9.1 AND libcupsys2-dev DPKG is earlier than 1.3.9-2ubuntu9.1 AND cupsys-common DPKG is earlier than 1.3.9-2ubuntu9.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libcups2-dev DPKG is earlier than 1.3.9-2ubuntu9.1 AND cups-bsd DPKG is earlier than 1.3.9-2ubuntu9.1 AND libcupsimage2-dev DPKG is earlier than 1.3.9-2ubuntu9.1 AND libcupsimage2 DPKG is earlier than 1.3.9-2ubuntu9.1 AND cups-client DPKG is earlier than 1.3.9-2ubuntu9.1 AND libcups2 DPKG is earlier than 1.3.9-2ubuntu9.1 AND cups-dbg DPKG is earlier than 1.3.9-2ubuntu9.1 AND cups DPKG is earlier than 1.3.9-2ubuntu9.1

Definition Id: oval:org.mitre.oval:def:7960

Oval ID:	oval:org.mitre.oval:def:7960
Title:	DSA-1773 cups -- integer overflow
Description:	It was discovered that the imagetops filter in cups, the Common UNIX Printing System, is prone to an integer overflow when reading malicious TIFF images.
Family:	unix	Class:	patch
Reference(s):	DSA-1773 CVE-2009-0163	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	cups
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section cupsys-bsd is earlier than 1.3.8-1lenny5 AND cups-common is earlier than 1.3.8-1lenny5 AND libcupsys2-dev is earlier than 1.3.8-1lenny5 AND cupsys-common is earlier than 1.3.8-1lenny5 AND cupsys-client is earlier than 1.3.8-1lenny5 AND cupsys-dbg is earlier than 1.3.8-1lenny5 AND cupsys is earlier than 1.3.8-1lenny5 AND libcupsys2 is earlier than 1.3.8-1lenny5 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libcups2-dev is earlier than 1.3.8-1lenny5 AND cups-bsd is earlier than 1.3.8-1lenny5 AND libcupsimage2-dev is earlier than 1.3.8-1lenny5 AND libcupsimage2 is earlier than 1.3.8-1lenny5 AND cups-client is earlier than 1.3.8-1lenny5 AND libcups2 is earlier than 1.3.8-1lenny5 AND cups-dbg is earlier than 1.3.8-1lenny5 AND cups is earlier than 1.3.8-1lenny5 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section libcupsys2-gnutls10 is earlier than 1.2.7-4etch7 AND cupsys-common is earlier than 1.2.7-4etch7 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is alpha AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section cupsys-bsd is earlier than 1.2.7-4etch7 AND cupsys-client is earlier than 1.2.7-4etch7 AND libcupsimage2 is earlier than 1.2.7-4etch7 AND libcupsimage2-dev is earlier than 1.2.7-4etch7 AND libcupsys2-dev is earlier than 1.2.7-4etch7 AND cupsys-dbg is earlier than 1.2.7-4etch7 AND cupsys is earlier than 1.2.7-4etch7 AND libcupsys2 is earlier than 1.2.7-4etch7

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apple Cups cpe:2.3:a:apple:cups:1.3.9:::::::* cpe:2.3:a:apple:cups:1.3.8:::::::* cpe:2.3:a:apple:cups:1.3.7:::::::* cpe:2.3:a:apple:cups:1.3.6:::::::* cpe:2.3:a:apple:cups:1.3.5:::::::* cpe:2.3:a:apple:cups:1.3.4:::::::* cpe:2.3:a:apple:cups:1.3.3:::::::* cpe:2.3:a:apple:cups:1.3.2:::::::* cpe:2.3:a:apple:cups:1.3.1:::::::* cpe:2.3:a:apple:cups:1.3.0:::::::* cpe:2.3:a:apple:cups:1.3:b1:::::: cpe:2.3:a:apple:cups:1.3:rc2:::::: cpe:2.3:a:apple:cups:1.3:rc1:::::: cpe:2.3:a:apple:cups:1.2.9:::::::* cpe:2.3:a:apple:cups:1.2.8:::::::* cpe:2.3:a:apple:cups:1.2.7:::::::* cpe:2.3:a:apple:cups:1.2.6:::::::* cpe:2.3:a:apple:cups:1.2.5:::::::* cpe:2.3:a:apple:cups:1.2.4:::::::* cpe:2.3:a:apple:cups:1.2.3:::::::* cpe:2.3:a:apple:cups:1.2.2:::::::* cpe:2.3:a:apple:cups:1.2.12:::::::* cpe:2.3:a:apple:cups:1.2.11:::::::* cpe:2.3:a:apple:cups:1.2.10:::::::* cpe:2.3:a:apple:cups:1.2.1:::::::* cpe:2.3:a:apple:cups:1.2.0:::::::* cpe:2.3:a:apple:cups:1.2:b2:::::: cpe:2.3:a:apple:cups:1.2:b1:::::: cpe:2.3:a:apple:cups:1.2:rc3:::::: cpe:2.3:a:apple:cups:1.2:rc1:::::: cpe:2.3:a:apple:cups:1.2:rc2:::::: cpe:2.3:a:apple:cups:1.1.9-1:::::::* cpe:2.3:a:apple:cups:1.1.9:::::::* cpe:2.3:a:apple:cups:1.1.8:::::::* cpe:2.3:a:apple:cups:1.1.7:::::::* cpe:2.3:a:apple:cups:1.1.6-3:::::::* cpe:2.3:a:apple:cups:1.1.6-2:::::::* cpe:2.3:a:apple:cups:1.1.6-1:::::::* cpe:2.3:a:apple:cups:1.1.6:::::::* cpe:2.3:a:apple:cups:1.1.5-2:::::::* cpe:2.3:a:apple:cups:1.1.5-1:::::::* cpe:2.3:a:apple:cups:1.1.5:::::::* cpe:2.3:a:apple:cups:1.1.4:::::::* cpe:2.3:a:apple:cups:1.1.3:::::::* cpe:2.3:a:apple:cups:1.1.23:::::::* cpe:2.3:a:apple:cups:1.1.23:rc1:::::: cpe:2.3:a:apple:cups:1.1.22:rc2:::::: cpe:2.3:a:apple:cups:1.1.22:::::::* cpe:2.3:a:apple:cups:1.1.22:rc1:::::: cpe:2.3:a:apple:cups:1.1.21:-:::::: cpe:2.3:a:apple:cups:1.1.21:rc2:::::: cpe:2.3:a:apple:cups:1.1.21:rc1:::::: cpe:2.3:a:apple:cups:1.1.21:::::::* cpe:2.3:a:apple:cups:1.1.20:rc6:::::: cpe:2.3:a:apple:cups:1.1.20:rc2:::::: cpe:2.3:a:apple:cups:1.1.20:::::::* cpe:2.3:a:apple:cups:1.1.20:rc5:::::: cpe:2.3:a:apple:cups:1.1.20:rc1:::::: cpe:2.3:a:apple:cups:1.1.20:rc4:::::: cpe:2.3:a:apple:cups:1.1.20:rc3:::::: cpe:2.3:a:apple:cups:1.1.2:::::::* cpe:2.3:a:apple:cups:1.1.19:rc2:::::: cpe:2.3:a:apple:cups:1.1.19:rc1:::::: cpe:2.3:a:apple:cups:1.1.19:::::::* cpe:2.3:a:apple:cups:1.1.19:rc5:::::: cpe:2.3:a:apple:cups:1.1.19:rc4:::::: cpe:2.3:a:apple:cups:1.1.19:rc3:::::: cpe:2.3:a:apple:cups:1.1.18:::::::* cpe:2.3:a:apple:cups:1.1.17:::::::* cpe:2.3:a:apple:cups:1.1.16:::::::* cpe:2.3:a:apple:cups:1.1.15:::::::* cpe:2.3:a:apple:cups:1.1.14:::::::* cpe:2.3:a:apple:cups:1.1.13:::::::* cpe:2.3:a:apple:cups:1.1.12:::::::* cpe:2.3:a:apple:cups:1.1.11:::::::* cpe:2.3:a:apple:cups:1.1.10-1:::::::* cpe:2.3:a:apple:cups:1.1.10:::::::* cpe:2.3:a:apple:cups:1.1.1:::::::* cpe:2.3:a:apple:cups:1.1:::::::* cpe:2.3:a:apple:cups:::::::: cpe:2.3:a:apple:cups:-:::::::*	81

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for cups CESA-2009:0429 centos5 i386 File : nvt/gb_CESA-2009_0429_cups_centos5_i386.nasl
2011-08-09	Name : CentOS Update for cups CESA-2009:0428 centos3 i386 File : nvt/gb_CESA-2009_0428_cups_centos3_i386.nasl
2011-08-09	Name : CentOS Update for cups CESA-2009:0429 centos4 i386 File : nvt/gb_CESA-2009_0429_cups_centos4_i386.nasl
2010-03-22	Name : Fedora Update for cups FEDORA-2010-2743 File : nvt/gb_fedora_2010_2743_cups_fc11.nasl
2009-12-14	Name : Mandriva Security Advisory MDVSA-2009:282-1 (cups) File : nvt/mdksa_2009_282_1.nasl
2009-12-10	Name : Fedora Core 11 FEDORA-2009-10891 (cups) File : nvt/fcore_2009_10891.nasl
2009-10-27	Name : Mandrake Security Advisory MDVSA-2009:283 (cups) File : nvt/mdksa_2009_283.nasl
2009-10-27	Name : Mandrake Security Advisory MDVSA-2009:282 (cups) File : nvt/mdksa_2009_282.nasl
2009-10-27	Name : Mandrake Security Advisory MDVSA-2009:281 (cups) File : nvt/mdksa_2009_281.nasl
2009-10-13	Name : SLES10: Security update for CUPS File : nvt/sles10_cups0.nasl
2009-10-11	Name : SLES11: Security update for CUPS File : nvt/sles11_cups.nasl
2009-10-10	Name : SLES9: Security update for CUPS File : nvt/sles9p5047860.nasl
2009-05-25	Name : CentOS Security Advisory CESA-2009:0429 (cups) File : nvt/ovcesa2009_0429.nasl
2009-05-11	Name : FreeBSD Ports: cups-base File : nvt/freebsd_cups-base8.nasl
2009-04-28	Name : Fedora Core 10 FEDORA-2009-3769 (cups) File : nvt/fcore_2009_3769.nasl
2009-04-28	Name : Gentoo Security Advisory GLSA 200904-20 (cups) File : nvt/glsa_200904_20.nasl
2009-04-28	Name : Fedora Core 9 FEDORA-2009-3753 (cups) File : nvt/fcore_2009_3753.nasl
2009-04-28	Name : SuSE Security Advisory SUSE-SA:2009:024 (cups) File : nvt/suse_sa_2009_024.nasl
2009-04-20	Name : Ubuntu USN-759-1 (poppler) File : nvt/ubuntu_759_1.nasl
2009-04-20	Name : RedHat Security Advisory RHSA-2009:0428 File : nvt/RHSA_2009_0428.nasl
2009-04-20	Name : Ubuntu USN-760-1 (cupsys) File : nvt/ubuntu_760_1.nasl
2009-04-20	Name : Debian Security Advisory DSA 1773-1 (cups) File : nvt/deb_1773_1.nasl
2009-04-20	Name : RedHat Security Advisory RHSA-2009:0429 File : nvt/RHSA_2009_0429.nasl
2009-04-17	Name : CUPS '_cupsImageReadTIFF()' Integer Overflow Vulnerability File : nvt/cups_cve_2009_0163.nasl
0000-00-00	Name : Slackware Advisory SSA:2009-116-01 cups File : nvt/esoft_slk_ssa_2009_116_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
54462	CUPS TIFF Image Decoding Routines Multiple Filter File Handling Overflows A remote overflow exists in CUPS. CUPS fails to handle a integer overflow in processing TIFF files resulting in a heaped-based buffer overflow. With a specially crafted request, an attacker can cause execution of arbitrary code resulting in a loss of integrity.

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0428.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0429.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090416_cups_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090416_cups_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2009-10-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-282.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cups-6174.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_cups-090416.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12396.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_cups-090416.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_cups-090416.nasl - Type : ACT_GATHER_INFO
2009-05-26	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0429.nasl - Type : ACT_GATHER_INFO
2009-05-08	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_736e55bc39bb11dea493001b77d09812.nasl - Type : ACT_GATHER_INFO
2009-04-27	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-116-01.nasl - Type : ACT_GATHER_INFO
2009-04-27	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200904-20.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-760-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote openSUSE host is missing a security update. File : suse_cups-6172.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2009-3769.nasl - Type : ACT_GATHER_INFO
2009-04-22	Name : The remote Fedora host is missing a security update. File : fedora_2009-3753.nasl - Type : ACT_GATHER_INFO
2009-04-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0428.nasl - Type : ACT_GATHER_INFO
2009-04-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0429.nasl - Type : ACT_GATHER_INFO
2009-04-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0428.nasl - Type : ACT_GATHER_INFO
2009-04-17	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1773.nasl - Type : ACT_GATHER_INFO
2009-04-17	Name : The remote printer service is affected by multiple vulnerabilities. File : cups_1_3_10.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:52:26	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	81
osvdb(s)	1
Openvas Exploit(s)	25
Nessus® Exploit(s)	23

	Related
6.8	CVE-2009-0163
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)